520
Security
System Event
The system time was changed.
Process ID: 1296
Process Name: C:\WINDOWS\system32\EVENTSENTRY\eventsentry_svc.exe
Primary User Name: WEBSERVER$
Primary Domain: MYDOMAIN
Primary Logon ID: (0x0,0x3E7)
Client User Name: WEBSERVER$
Client Domain: MYDOMAIN
Client Logon ID: (0x0,0x3E7)
Previous Time: 8:57:01 PM 8/31/2011
New Time: 8:57:06 PM 8/31/2011
This event is logged when the NTP (network time protocol) feature in the EventSentry agent adjusts the local time, after a significant time difference has been detected.
Please note that this event is only logged when auditing of system events is enabled in the local or domain group policy.